Sources
Everything on our lists starts with someone else's hard work. These are the teams whose public research we read every day. If you find their reports useful, follow them directly: they go into far more depth than a block list can.
How we use their work
- We read each team's public RSS feed, the same way any feed reader does.
- We take the indicators the authors published for defenders to use: domain names, IP addresses, URLs and file hashes. These are facts, published to be acted on.
- On this site we show the article title, the publisher and a link back to the original report. We don't copy or republish their articles.
- Names and trademarks belong to their owners. Listing a source here doesn't mean it endorses WatchmanHQ or has reviewed our lists.
- One publisher counts once, however many posts it writes about the same thing, and a write-up of someone else's findings counts with the original report. See Methodology.
Publishers: if you'd like us to credit your work differently, or to stop using your feed, email hello@watchmanhq.com and we'll do it.
Threat research teams
| Source | Who they are |
|---|---|
| The DFIR Report | Detailed write-ups of real intrusions, step by step |
| Cisco Talos | Cisco's threat intelligence and research group |
| Unit 42 | Palo Alto Networks' threat research team |
| Securelist | Kaspersky's research and analysis team |
| SentinelLabs | SentinelOne's research team |
| Check Point Research | Check Point's threat research team |
| Volexity | Incident response and memory forensics specialists |
| Google Threat Intelligence / Mandiant | Google Cloud's threat intelligence team, including Mandiant |
| Microsoft Threat Intelligence | Microsoft's threat intelligence team |
| Proofpoint Threat Insight | Email and social-engineering threat research |
| Sophos Threat Research | Sophos X-Ops research |
| Elastic Security Labs | Elastic's security research team |
| Fortinet Threat Research | FortiGuard Labs research |
| Zscaler ThreatLabz | Zscaler's research team |
| ESET WeLiveSecurity | ESET's research blog |
| Sekoia | Sekoia's threat detection and research team |
| Group-IB | Group-IB's threat intelligence research |
| Huntress | Research from a security company that focuses on small and mid-sized organizations |
| ANY.RUN | Malware analysis from an interactive sandbox |
| Red Canary | Detection and response research |
| Malwarebytes Labs | Malwarebytes' research and consumer advice |
| Rapid7 | Rapid7's research team |
| Recorded Future Insikt Group | Recorded Future's research group |
| Infoblox Threat Intel | DNS-focused threat research |
| Silent Push | Research into attacker infrastructure |
| ReversingLabs | Malware and software supply chain research |
| Censys | Research from internet-wide scanning |
| Darktrace | Darktrace's threat research |
| Arctic Wolf | Arctic Wolf Labs research |
| Bitdefender Labs | Bitdefender's research |
| Cyble | Cyble's research team |
| Seqrite | Seqrite Labs, Quick Heal's enterprise research team |
| Lab52 | S2 Grupo's threat intelligence team |
| K7 Labs | K7 Computing's research team |
| NVISO Labs | NVISO's research blog |
| Socket | Security research on open-source packages |
Mac and Apple threats
| Source | Who they are |
|---|---|
| Objective-See | Non-profit Mac security research and free tools |
| Jamf Threat Labs | Apple-platform threat research |
Government and community
| Source | Who they are |
|---|---|
| CISA Cybersecurity Advisories | The US Cybersecurity and Infrastructure Security Agency |
| SANS Internet Storm Center | Daily diaries from SANS's volunteer incident handlers |
Security journalism
These usually report other teams' findings and link to them. When they do, the indicator counts with the original report, not as a second confirmation.
| Source | Who they are |
|---|---|
| KrebsOnSecurity | Investigative security journalism |
| BleepingComputer | Security and technology news |